Add production deployment guide and harden compose for it

- docker-compose.yml: bind client/server ports to 127.0.0.1 only — the
  client container is the sole intended public entry point (it proxies
  /api/* to the server itself), a host-level nginx sits in front of it in
  production. Client__Origin now configurable via CLIENT_ORIGIN env var.
- docs/DEPLOY.md: step-by-step for a fresh Linux target (Docker install,
  clone, .env secrets, nginx + certbot).
- docs/CI-CD.md: runner registration for that same target machine, in
  "host" mode so the deploy step's `docker compose up -d` acts on the
  actual running stack.

.env.example

@@ -6,3 +6,10 @@ JWT_SECRET=dev-secret-change-me-please-32-chars-min
 
 # Optional — defaults to "devpassword" if unset.
 POSTGRES_PASSWORD=devpassword
+
+# Effectively unused now that the client talks to the API via a same-origin
+# /api/* proxy (see src/Client/nginx.conf) rather than a cross-origin
+# request — CORS just never triggers. Left configurable as a defensive
+# fallback; defaults to http://localhost:8081 if unset. For production set
+# it to the real public origin, e.g. https://ruvdstest.danamir.site
+CLIENT_ORIGIN=http://localhost:8081